scottctr (Community Member) asked a question.
I'm new to using the pipeline scan, but it doesn't look like all of our files are being scanned. I'm uploading via an ADO pipeline. Here's the code:
curl https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip -O "F:/pipeline-scan-LATEST.zip"
C:\tools\ZipUnzip\unzip F:/pipeline-scan-LATEST -d F:/VCScan
java -jar F:/VCScan/pipeline-scan.jar -vid $(VERACODE_API_ID) -vkey $(VERACODE_API_KEY) -f $(Build.ArtifactStagingDirectory)/publish.zip
The publish.zip file we’re uploading is about 31MB and includes 1 exe (our app) and dozens of dll’s (4 of which are specific to our app), but our results only showing scanning 2 modules:
{
...snip...
"scan_status": "SUCCESS",
"message": "Scan successful. Results size: 42 bytes",
"modules": [
"eviCore.Bus.Kafka.dll",
"eviCore.Bus.ServiceFabric.dll"
],
"modules_count": 2,
"findings": [],
"pipeline_scan": "21.9.0-0",
"dev_stage": "DEVELOPMENT"
}
.png){kind=logo}
Hello @scottctr (Community Member) ,
A most likely reason that a pipeline scan could fail can be improperly prepared files. Please take a look at these Help Center articles:
Jason
Veracode Support Engineer
Hi,
I seem to be having this same issue. I have an .Net 6 ASP.Net Core web service application that we're trying to get set up for pipeline scans. Whenever I run the pipeline scan it reports scanning a fraction of the first-party assemblies included in the ZIP file (none of which are the starting point for the application). I've followed the instructions linked above to no avail. I've tried packaging using the dotnet command line tool and with the Veracode VS2022 extension to no avail. The extension ends up packaging the build output of all our projects in the solution, including our test projects which we don't need to have scanned. In both cases, the list of modules scanned is incomplete. I can upload our ZIP file and run the scan in a sandbox, but I still have to manually select the modules to be scanned. I can't seem to find any information about how Veracode determines which modules to scan.
Thank you,
Ted Weiler